Apple releases update to iOS to fix hidden file

Apple (AAPL) on Wednesday released its software fix to the hidden iPhone location file that researchers brought to light last month.

Privacy advocates praised Apple's move, which addressed what the company had called software "bugs." But they said the company hasn't gone far enough and urged Apple to give iPhone users more information about what's being done with their location data and more control of how it is used.

"This is a good step," said Jeff Chester, executive director of the Center for Digital Democracy, a consumer advocacy group. But, he added, "the fix is not going to address the mobile marketing and consumer privacy issues."

The fix, which Apple announced last week, comes in the form of a free update to the iOS operating system that runs on the iPhone and other Apple mobile devices including the iPad. Owners of recent iOS devices can install the update when they sync them to iTunes on their computers. But owners of older iOS gadgets cannot; Apple did not release a fix for their devices.

The hidden file logs the locations of Wi-Fi hot spots and cellphone towers near iOS devices, essentially revealing users' movements over time. Researchers Pete Warden and Alasdair Allan found that the file could contain location data dating back nearly a year.

Advertisement

Warden and Allan also found that the file could be accessed on users' computers in the backup folders created when they sync their devices to iTunes. And they found that the file continued to track users' movement even when they had turned off the location services feature on their iOS devices.

Apple has said that the file is used to help its phones and other gadgets find their locations much more quickly than if they had to rely solely on GPS satellites. The company says it is not keeping track of individual users.

The iOS update seeks to address many of the issues with the location file identified by the researchers. According to Apple, the update will limit the amount of data kept in the location file, prevent iTunes from backing up the file to users' computers and delete all information in the file when users turn off location services.

However, the update doesn't necessarily address all the concerns critics have raised about the file. Apple has said previously that it will continue to store seven days worth of location data in the file even after the update. Forensics researchers, who have said that they have been using the location data stored in the file in criminal and other legal investigations, said even that amount of data would still be useful in their work.

Even limited to just seven days, the data represents users' "most recent digital fingerprints," said Amber Schroader, owner of Paraben, which makes forensic software for investigators and the general public. "That is absolutely valuable in an investigation."

That concerns privacy advocates.

Apple's fix "still only seems to be a partial step," said John Simpson, director of advocacy group Consumer Watchdog's privacy project.

Meanwhile, Apple has not made a version of the update available for older iOS gadgets. Among the devices that won't get the fix are the original iPhone, the iPhone 3G and the first and second iterations of the iPod touch.

The iPhone 3G and the second generation iPod touch both can run versions of iOS 4, which includes the tracking file found by the researchers. The original iPhone and the first-generation iPod touch can run versions of iOS 3, which, according to forensics researchers, includes an earlier version of the tracking file. Apple sold more than 20 million iPhones and iPhone 3G's and untold millions of the first two generations of the iPod touch.

Apple has a responsibility to address the location file for all affected users, including those using older devices, Chester said. The company ought to take a lesson from how automobile companies respond when they find design defects, he said.

"Apple should engage in a recall," he said. "This is a very serious design flaw they made."

The Apple representative declined to comment on why the company didn't release a version of the update for older iOS devices.

The publicity surrounding the location file has brought greater scrutiny to the collection of location and other data from phone users by mobile companies. Representatives of both Apple and Google (GOOG) have been asked to testify at a Senate hearing next week regarding such data collection.

Contact Troy Wolverton at 408-920-5021. Follow him at Twitter.com/troywolv.